lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 17 Dec 2012 15:13:00 -0600
From: Christopher Emerson <christopher.emerson@...teoaksecurity.com>
To: full-disclosure@...ts.grok.org.uk
Subject: WordPress 3.4.2: Sessions Not Terminated Upon
	Explicit User Logout [CVE-2012-5868]

*Summary
=======
WordPress 3.4.2 fails to invalidate a user’s sessions upon logout.

WordPress was originally notified of this issue in November 15, 2012.

CVE number: CVE-2012-5868
Impact: Medium
Vendor homepage: http://wordpress.com/
Vendor notified: 11/2012
Vendor fixed: N/A
Credit: Christopher Emerson of White Oak Security
(http://www.whiteoaksecurity.com/)

Affected Products
======== ========
Confirmed in self-hosted version WordPress 3.4.2.  Other versions may also
be affected.

Details
=======
When a user explicitly logs out of the WordPress 3.4.2 Administrator
interface via the logout link
(https://domainname.com/wp-login.php?action=logout),
Wordpress clears the cookies in the user’s browser, but fails to invalidate
the session cookie within the application.

A malicious user can take a a previously authenticated user’s session
cookie (wordpress_sec), add that cookie to a request for the administrator
interface (example https://domainname.com/wp-admin/profile.php), and they
will have access to the interface with the same roles and privileges as the
original valid user.

Impact
======
This vulnerability lengthens the windows for brute force session identifier
guessing attacks and session identifier replay attacks.  Successful
exploitation would allow attackers to masquerade as the victim within the
application.

Solution
========
Since the WordPress does not have server side session management, the
application should keep track of session identifiers where a user has
explicitly logged out, and prevent those sessions from connecting to the
application.


Distribution
============
This vulnerability was published publicly on December 17th, 2012.

*

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists